Denial of service in Oracle MySQL Server and MySQL Cluster 26.7.0-26.7.1 lets a high-privileged, network-positioned user trigger hangs or repeatable crashes in the Server: Security: Encryption component. The flaw is remotely reachable via multiple MySQL protocols with low attack complexity once the attacker already holds an administrative MySQL account, and it affects availability only (CVSS 3.1 4.9, A:H). No public exploit identified at time of analysis; the high-privilege prerequisite confines practical risk to trusted insiders or post-compromise scenarios.
Denial of service in Oracle MySQL Server and MySQL Cluster (Server: Replication component) lets a high-privileged, network-reachable database account hang or repeatedly crash the service, affecting MySQL Server 8.4.0-8.4.12, 9.7.0-9.7.3 and 26.7.0-26.7.1 as well as MySQL Cluster 8.0.0-8.0.49, 8.4.0-8.4.12, 9.7.0-9.7.3 and 26.7.0-26.7.1. The CVSS 3.1 base score is 4.9 (AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:H), so impact is availability-only and the attack path is gated behind elevated MySQL privileges - this is a privileged-insider or post-compromise persistence-of-disruption scenario rather than an anonymous remote attack. There is no CISA KEV listing and no public exploit code identified at time of analysis; Oracle addresses the flaw in its October 2026 Critical Patch Update.
Denial of service in MySQL Server and MySQL Cluster is possible when a high-privileged, authenticated attacker submits a crafted query that is mishandled by the Server Optimizer. The issue affects MySQL Server 8.4.0-8.4.12, 9.7.0-9.7.3, and 26.7.0-26.7.1, plus MySQL Cluster 8.0.0-8.0.49, 8.4.0-8.4.12, 9.7.0-9.7.3, and 26.7.0-26.7.1; successful exploitation causes a hang or repeatable crash. No public exploit has been identified at time of analysis, and this CVE is not listed in CISA KEV.
High-privilege denial of service in Oracle MySQL Server (InnoDB) and MySQL Cluster lets an attacker who already holds elevated database privileges crash or hang the service over the network, causing complete loss of availability. Affected builds span MySQL Server 8.4.0-8.4.12, 9.7.0-9.7.3 and 26.7.0-26.7.1, plus MySQL Cluster 8.0.0-8.0.49, 8.4.0-8.4.12, 9.7.0-9.7.3 and 26.7.0-26.7.1. No public exploit code or confirmed active exploitation (CISA KEV) was identified at time of analysis; because exploitation requires high privileges, this is primarily an insider or post-compromise risk rather than a remotely exploitable unauthenticated threat (CVSS 4.9).
Authenticated high-privileged users can force InnoDB in MySQL Server or MySQL Cluster to hang or crash repeatedly by sending crafted requests over the network through multiple MySQL protocols, producing a complete denial of service with no confidentiality or integrity impact. Affected releases include MySQL Server 8.4.0-8.4.12, 9.7.0-9.7.3, 26.7.0-26.7.1 and MySQL Cluster 8.0.0-8.0.49, 8.4.0-8.4.12, 9.7.0-9.7.3, 26.7.0-26.7.1. No public exploit code or CISA KEV entry is identified at time of analysis, and the high-privilege prerequisite makes this a moderate-to-low priority issue despite the broad deployment of MySQL.
High-privileged users of affected MySQL Server 8.4.x, 9.7.x, and 26.7.x releases, as well as MySQL Cluster 8.0.x, 8.4.x, 9.7.x, and 26.7.x, can crash or hang the InnoDB-backed service over network protocols, causing a complete denial of service. The CVSS 3.1 score is 4.9 (AV:N/AC:L/PR:H/UI:N/C:N/I:N/A:H), so exploitation requires an authenticated account with high database privileges and provides no data confidentiality or integrity impact. No public exploit code or CISA KEV entry is identified at time of analysis, and Oracle's October 2026 Critical Patch Update is the vendor reference.
A high-privileged database account is enough for an attacker with network reachability to hang or repeatedly crash MySQL Server and MySQL Cluster, because a flaw in the InnoDB storage engine can be triggered over supported protocols with low attack complexity (CVSS 3.1: 4.9, AV:N/AC:L/PR:H/UI:N/C:N/I:N/A:H). MySQL Server 8.4.0-8.4.12, 9.7.0-9.7.3 and 26.7.0-26.7.1, and MySQL Cluster 8.0.0-8.0.49, 8.4.0-8.4.12, 9.7.0-9.7.3 and 26.7.0-26.7.1 are affected. Impact is availability only, no public exploit code was identified at time of analysis, and the issue is not in CISA KEV.
Denial-of-service in Oracle MySQL Server and MySQL Cluster lets a high-privileged database user trigger a hang or repeatable crash through crafted DDL operations sent over the network via supported database protocols. Affected releases are MySQL Server 8.4.0-8.4.12, 9.7.0-9.7.3 and 26.7.0-26.7.1, plus MySQL Cluster 8.0.0-8.0.49, 8.4.0-8.4.12, 9.7.0-9.7.3 and 26.7.0-26.7.1. Because the attack requires an already-privileged (DBA-level) account, the realistic threat is a malicious insider or an adversary who has already compromised administrative database credentials; there is no confidentiality or integrity impact, no user interaction, and no public exploit identified at time of analysis. Scoring is CVSS 3.1 4.9 (AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:H).
High-privileged MySQL accounts can hang or repeatedly crash MySQL Server 8.4.0-8.4.12, 9.7.0-9.7.3, and 26.7.0-26.7.1, as well as MySQL Cluster 8.0.0-8.0.49, 8.4.0-8.4.12, 9.7.0-9.7.3, and 26.7.0-26.7.1, by sending crafted queries that trigger a defect in the Server: Optimizer component, producing availability-only denial of service (CVSS 3.1 4.9). Exploitation requires an authenticated, high-privileged account (PR:H) with network reachability and no user interaction; confidentiality and integrity are unaffected. No public exploit identified at time of analysis.
Oracle E-Business Suite 12.2.3 through 12.2.15 can expose critical application data through the Applications Framework Web Utilities component when an attacker who already holds high E-Business Suite privileges sends crafted HTTP requests. The issue is rated CVSS 4.9 with a confidentiality-only impact and a high-privilege prerequisite (PR:H), so it is a moderate-risk, high-prerequisite flaw rather than a pre-authentication emergency. No public exploit code or CISA KEV entry was identified at time of analysis, and no EPSS score was supplied.
Oracle ORDS 24.2.0 through 26.1.0 allows a high-privileged, network-positioned attacker to create, delete, or modify critical data through the ORDS HTTP interface, with no confidentiality or availability impact. This is a moderate-severity integrity flaw (CVSS 3.1 base 4.9, AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:H/A:N) that requires the attacker to already hold high privileges on the target instance; despite the supplied 'Authentication Bypass' tag, the confirmed vector does not describe an authentication-bypass or unauthenticated path. No public exploit identified at time of analysis, and no CISA KEV confirmation or EPSS score is included in the available data.
Oracle MySQL Server and MySQL Cluster deployments that run the Group Replication plugin (Server: Group Replication Plugin) can be driven into a hang or a frequently repeatable crash by a high-privileged, network-reachable database account, producing a complete denial of service on the affected instance. The issue affects MySQL Server 8.4.0-8.4.12, 9.7.0-9.7.3 and 26.7.0-26.7.1, and MySQL Cluster 8.0.0-8.0.49, 8.4.0-8.4.12, 9.7.0-9.7.3 and 26.7.0-26.7.1; standalone servers that do not enable Group Replication are outside the exploitable path. The CVSS 3.1 base score is 4.9 (MEDIUM) with availability-only impact, and no public exploit identified at time of analysis; because the vector requires PR:H, exploitation is limited to trusted or already-compromised privileged accounts. Fixes are referenced through Oracle's October 2026 Critical Patch Update advisory.
High-privilege MySQL accounts can crash InnoDB-backed MySQL Server and MySQL Cluster instances by sending crafted requests over supported network protocols, causing a hang or repeatable full denial of service. Affected builds include MySQL Server 8.4.0-8.4.12, 9.7.0-9.7.3, and 26.7.0-26.7.1, as well as MySQL Cluster 8.0.0-8.0.49, 8.4.0-8.4.12, 9.7.0-9.7.3, and 26.7.0-26.7.1. The CVSS 3.1 score is 4.9 (AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:H); no CISA KEV entry or public exploit code was supplied, and the high-privilege prerequisite limits practical exposure to insiders or already-compromised accounts.
Denial of service in MySQL Server and MySQL Cluster allows a high-privileged authenticated attacker with network access to trigger a hang or frequently repeatable crash in the InnoDB component, affecting availability only. The issue is rated CVSS 3.1 4.9 and applies to MySQL Server 8.4.0-8.4.12, 9.7.0-9.7.3, and 26.7.0-26.7.1, plus MySQL Cluster 8.0.0-8.0.49, 8.4.0-8.4.12, 9.7.0-9.7.3, and 26.7.0-26.7.1. Exploitation requires an already privileged database account, so risk is concentrated in shared-DBA or multi-tenant environments; no public exploit identified at time of analysis.
Denial of service in Oracle MySQL Server and MySQL Cluster allows a high-privileged, network-reachable database account to hang or repeatedly crash the server through a flaw in the InnoDB storage engine. Only instances running InnoDB are affected, specifically MySQL Server 8.4.0-8.4.12, 9.7.0-9.7.3, 26.7.0-26.7.1 and MySQL Cluster 8.0.0-8.0.49, 8.4.0-8.4.12, 9.7.0-9.7.3, 26.7.0-26.7.1. The CVSS 3.1 vector (AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:H, score 4.9) confirms the critical limiting factor: the attacker must already hold HIGH database privileges, so this is not exploitable by unauthenticated or low-privileged users, and impact is confined to availability with no disclosure or modification of data. No public exploit code or CISA KEV entry was identified at time of analysis, and the high-privilege precondition keeps real-world risk low-to-moderate despite the ubiquity of MySQL.
Denial of service in Oracle MySQL Server and MySQL Cluster: a high-privileged, network-reachable database account can drive the InnoDB storage engine into a hang or a repeatable crash, taking the service down. Only MySQL Server 8.4.0-8.4.12, 9.7.0-9.7.3, 26.7.0-26.7.1 and MySQL Cluster 8.0.0-8.0.49, 8.4.0-8.4.12, 9.7.0-9.7.3, 26.7.0-26.7.1 are affected; confidentiality and integrity are untouched (CVSS 3.1 base 4.9, AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:H). No public exploit code or confirmed active exploitation (CISA KEV) was identified at time of analysis, and the PR:H prerequisite confines the realistic threat model to insiders or compromised privileged accounts rather than anonymous remote attackers.
Denial of service in MySQL Server and MySQL Cluster allows an authenticated attacker with high privileges and network access to cause a hang or repeatable crash of the database service. Affected releases include MySQL Server 8.4.0-8.4.12, 9.7.0-9.7.3, and 26.7.0-26.7.1, plus MySQL Cluster 8.0.0-8.0.49, 8.4.0-8.4.12, 9.7.0-9.7.3, and 26.7.0-26.7.1. No public exploit was identified at time of analysis, and the high-privilege prerequisite substantially limits the realistic threat to insiders or compromised privileged accounts.
Low-privileged authenticated users of Oracle PeopleSoft Enterprise PeopleTools 8.61 through 8.63 can abuse the Notification Configuration component over HTTP to read a limited subset of application data and to update, insert, or delete some of it, with a scope change that can extend impact to integrated PeopleSoft products. Oracle scores this 4.9 (CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:C/C:L/I:L/A:N): a valid account is mandatory, no victim interaction is required, and there is no availability impact, but the high attack complexity means success hinges on conditions outside the attacker's control, making this a moderate rather than high-urgency issue. No public exploit code or confirmed active exploitation (CISA KEV) was identified at time of analysis.
An out-of-bounds read exists in the Eclipse ThreadX USBX host stack's USB Video Class handling: when a malicious USB device declares a VideoStreaming interface wTotalLength larger than the format, frame, and frame-interval descriptors it actually transmits, the host trusts that self-reported size as its parsing budget and walks past the end of the configuration buffer. The bug is only triggered when the application queries format or frame data, not during enumeration, and requires physically attaching a crafted USB device to a host built with USBX video-class host support. No public exploit code or active exploitation was identified at time of analysis, and the physical attack vector keeps practical risk low-to-moderate despite potential information disclosure and host-context denial of service.
Heap out-of-bounds read in the Eclipse ThreadX USBX USB host HID class driver is triggered during ordinary device enumeration when a physically attached HID peripheral returns a short or truncated report descriptor whose item headers declare more payload bytes than were actually transferred. The flaw affects USBX builds configured as a USB host with HID support, requires physical access and a user action to connect the device, and needs no authentication (CVSS 3.1: 4.9, AV:P/AC:L/PR:N/UI:R), with the main impact being a crash or denial of service plus limited information disclosure. No public exploit code or confirmed active exploitation was identified at the time of analysis.
Stored cross-site scripting in Cachet 2.4.1 and earlier allows a high-privilege authenticated operator to inject malicious HTML/JavaScript into incident messages and other Markdown-rendered status-page fields, with the payload executing when a victim views the public status page and potentially enabling session-token theft or account takeover. Exploitation is constrained by the PR:H requirement and victim interaction (UI:R), and no public exploit was identified at time of analysis. The independent assessment rates real-world risk as low-to-moderate; upstream fixes are available in the referenced cachethq/core commits, but a released patched version was not independently confirmed.
Oracle JD Edwards EnterpriseOne Tools releases 9.2.0.0 through 9.2.26.5 contain a difficult-to-exploit flaw in the Enterprise Infrastructure SEC component reachable over SMTP, allowing unauthenticated network attackers to make limited unauthorized data changes and cause a partial denial of service. Oracle assigns CVSS 3.1 base score 4.8 with high attack complexity and no confidentiality impact; no public exploit identified at time of analysis. Exposure is limited to deployments that expose or process attacker-reachable SMTP traffic under the specific conditions Oracle describes as difficult.
Unauthenticated network attackers can read a subset of and modify some Human Resources data in JD Edwards EnterpriseOne 9.2 via the JDENET service, but Oracle rates the issue difficult to exploit because of high attack complexity. The CVSS 3.1 base score is 4.8 (AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:N), with limited confidentiality and integrity impact and no availability effect. No public exploit identified at time of analysis and no CISA KEV entry is present, so this is a routine patch-cycle item rather than an emergency.
Limited read and write access to PeopleSoft Enterprise PeopleTools Portal data is achievable by unauthenticated remote attackers in versions 8.61 through 8.63, though exploitation is rated difficult (AC:H) and depends on conditions outside the attacker's control. Oracle assigns CVSS 3.1 base 4.8 (C:L/I:L/A:N); no public exploit code or CISA KEV entry was identified at time of analysis. Patch on a normal cycle rather than treating this as an emergency.
Partial data disclosure and unauthorized modification in Oracle Java SE (8u503/8u503-perf, 11.0.32.1, 17.0.20.1, 21.0.12.1, 25.0.4.1 and 27), plus Oracle GraalVM for JDK 17.0.20.1/21.0.12.1 and GraalVM Enterprise Edition 21.3.19.1.1, stem from a flaw in the 'Security' component that becomes reachable when an application or web service passes attacker-supplied data into those APIs, or when sandboxed Java Web Start/applet deployments execute untrusted code and rely on the Java sandbox for isolation. Network attackers need no credentials (PR:N) and no user interaction (UI:N), but High attack complexity (AC:H) means success depends on conditions the attacker cannot directly control, so exploitation is unreliable; impact is confined to partial read and partial modify of a subset of Java-accessible data with no availability effect (CVSS 3.1 base 4.8, MEDIUM). No public exploit code and no confirmed active exploitation (CISA KEV) were identified at time of analysis.
Unauthorized data modification and limited information disclosure in Oracle Java SE (21.0.12.1, 25.0.4.1, and 27) occur when attacker-supplied data reaches the APIs of the Compiler component through a network-facing service. Rated CVSS 4.8 (AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:N), the flaw is unauthenticated and needs no user interaction, but Oracle explicitly scopes reachability to applications that pass untrusted data into the Compiler APIs directly - not via Java Web Start or applets - and the high attack complexity means success depends on conditions the attacker does not fully control. No public exploit code or confirmed active exploitation was identified at time of analysis.
Unauthorized read and limited insert/update/delete access to Oracle Communications Billing and Revenue Management (BRM) Server 15.x data is possible for unauthenticated network attackers via the HTTP interface, though Oracle rates exploitation as difficult (AC:H). The flaw affects BRM Server versions 15.0.0.0.0, 15.0.1.0.0, 15.1.0.0.0, and 15.2.0.0.0 and carries a CVSS 3.1 base score of 4.8 with only low confidentiality and integrity impact and no availability impact. No public exploit code or CISA KEV entry was identified at time of analysis; this is a normal-cycle patch rather than an emergency.
Unauthenticated attackers who can reach the Marketing component of Oracle Siebel CRM (Siebel Apps - Marketing, versions 17.0 through 26.9) over HTTPS can read a subset of Marketing data and perform unauthorized updates, inserts or deletions on some records, with no availability impact. Oracle scores this CVSS 3.1 at 4.8 because of high attack complexity - the vendor describes it as 'difficult to exploit,' meaning a server-side condition outside the attacker's direct control (state, timing, or a non-default configuration) must be satisfied, even though no credentials (PR:N) and no user interaction (UI:N) are required. No public exploit code and no confirmed active exploitation (CISA KEV) were identified at time of analysis, so real-world risk is bounded to internet-exposed Marketing deployments and to partial Low confidentiality/integrity loss.
Host canonicalization divergence in fast-uri 2.4.2-2.4.7, 3.1.3-3.1.8, and 4.0.1-4.2.2 can let unauthenticated remote attackers steer traffic past host-based denylists, loopback filters, redirect allow-lists, or outbound proxy routing when an application checks a host representation that differs from fast-uri’s canonical output. The parser’s canonicalizeHost() adopts the WHATWG URL parser hostname without confirming the whole authority was consumed, so an authority with more than one at-sign or embedded tab, carriage return, or line feed is silently rewritten and no parse error is raised. The flaw is fixed in 2.4.8, 3.1.9, and 4.2.3; no public exploit code was identified at time of analysis, and impact is limited to misdirected traffic rather than code execution or availability loss.
Hard-to-exploit confidentiality and integrity exposure in Oracle Java SE's Compiler component affects the 8u503-perf, 11.0.32.1, 17.0.20.1, 21.0.12.1, 25.0.4.1 and 27 releases as well as Oracle GraalVM for JDK 17.0.20.1/21.0.12.1 and GraalVM Enterprise Edition 21.3.19.1.1, letting a remote attacker who supplies data to the affected APIs read a subset of accessible data and perform unauthorized updates, inserts or deletes. The CVSS 3.1 vector (AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:N, base 4.8) reflects no authentication or user-interaction requirement but a high attack complexity that depends on conditions the attacker does not control, so practical exploitability is limited; no public exploit code and no confirmed active exploitation were identified at time of analysis, and Oracle explicitly excludes Untrusted Java Web Start applications and Untrusted Java applets as attack paths.
Partial confidentiality and integrity compromise in Oracle Java SE (8u503, 11.0.32.1, 17.0.20.1, 21.0.12.1, 25.0.4.1, 27) and the corresponding Oracle GraalVM for JDK and GraalVM Enterprise Edition releases arises from weaknesses in the Serviceability component's APIs, which an unauthenticated, network-reachable attacker can reach by supplying crafted data through a web service or another supported protocol. Oracle rates the issue as difficult to exploit due to high attack complexity, and the impact is bounded to unauthorized read of a subset of data plus unauthorized update, insert, or delete access to some data, with no effect on availability. No public exploit code and no CISA KEV listing were identified at time of analysis, and despite the ubiquity of the Java platform this scores only 4.8 - a genuinely moderate-severity, low-priority issue that still merits routine patch-cycle handling.
War Thunder versions 2.57.1.140 through 2.59.0.9 send the auth_jwt bearer token in the first data packet after the TCP handshake using LZ4 compression instead of encryption, so an on-path attacker can passively capture and decompress the packet to temporarily impersonate the user. The impact is limited to unauthorized gameplay access and low-sensitivity profile data such as email address and displayed phone number; it does not enable password changes, security-setting changes, 2FA management bypass, or financial access. No public exploit code or confirmed active exploitation was identified at time of analysis, and the CVSS vector rates this as high attack complexity with CVSS 4.8.
Bandizip for Windows before 7.47 fails to propagate the Mark-of-the-Web to extracted .ps1 and .psm1 files, defeating the zone check that normally requires downloaded PowerShell scripts to be signed under the RemoteSigned execution policy. The flaw lets a local attacker deliver an unsigned script inside an archive and have it run when the victim extracts and manually invokes it; no privileges are required, but user interaction is essential and the resulting impact is limited to low integrity. No public exploit has been identified at time of analysis, and the issue is best treated as a modest protection-mechanism bypass rather than an emergency remote code-execution risk.
Out-of-bounds read in the Eclipse ThreadX Module Manager's block-pool create dispatcher (_txm_module_manager_tx_block_pool_create_dispatch) lets a loaded, memory-protected module cause the kernel to read words it does not own. The dispatcher verifies only two ALIGN_TYPE words of the caller-supplied extra-parameter array, but then uses indices 0 through 3, and the out-of-bounds access happens inside the validation path itself: index 1 is taken as the pool start and index 2 as the length used to range-check it, so the size the pool start is checked against is itself an unverified word, and a further unverified word is consumed when the service argument list is built. Affected are builds using the ThreadX Module Manager with MPU-isolated modules; the vector is CVSS:4.0/AV:L/AC:L/PR:L/UI:N/VC:L/VI:N/VA:L (4.8) and our independent assessment agrees it is local, requires an already-loaded low-privilege module, and is bounded to information disclosure plus possible fault rather than code execution. No public exploit identified at time of analysis, and the issue is not in CISA KEV.
Eclipse ThreadX's memory-protected module support under-validates queue extents in the front-send path: the Module Manager's dispatch layer receives a value counted in ULONGs where it expects a byte extent, so the privileged copy in _txe_queue_front_send reads up to 3 x message_size bytes past the end of the memory a loaded module is permitted to read. The over-read words land in the queue's message area, meaning a second module (or the same one) that can receive from that queue can retrieve the adjacent memory contents. Exploitation is strictly local and requires the attacker to already control a loaded low-privilege module authorized to front-send on the target queue; there is no public exploit code and no confirmed active exploitation (no public exploit identified at time of analysis), and the assessed impact is limited information disclosure plus a possible availability effect, consistent with the 4.8 CVSS 4.0 / 4.8 CVSS 3.1 ratings.
Stored cross-site scripting in Chatwoot before 4.14.0 allows authenticated account administrators with Help Center authoring rights to inject JavaScript into publicly visible articles via crafted video-embed links that break out of an iframe src attribute. The flaw is rated CVSS 4.0 base 4.8 (Medium) and requires a public visitor to view the crafted article; no public exploit was identified at time of analysis. Vendor-released patch: 4.14.0.
Oracle REST Data Services (ORDS) versions 24.2.0 through 26.1.0 expose an access-control weakness in the Database Actions component that lets an attacker who already holds high privileges on the ORDS instance reach it over HTTP and perform unauthorized reads, inserts, updates and deletes against a subset of ORDS-accessible data, while also degrading availability enough to cause a partial denial of service. Because the vector is PR:H with UI:N and AC:L (CVSS 3.1 base 4.7), the practical barrier is not exploitation difficulty but the requirement for an already-privileged account that can touch the Database Actions endpoint; unauthenticated internet exposure alone does not enable the attack. No public exploit code and no confirmed active exploitation were identified at time of analysis, and no EPSS score was supplied, so this is a moderate-severity integrity/confidentiality issue for privileged-account compromise and insider-risk scenarios rather than an urgent perimeter emergency.
High-privileged users of Oracle REST Data Services (ORDS) 24.2.0 through 26.1.0 can abuse the Database Actions component over HTTP to read and modify a limited subset of ORDS-accessible data and to cause a partial denial of service. The flaw is easily triggered once administrative or operator-level privileges are already held (CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:L/I:L/A:L, base score 4.7), so the privilege prerequisite rather than technical complexity is the main barrier. There is no public exploit identified at time of analysis and no CISA KEV listing; Oracle addresses it in its October 2026 Critical Patch Update.
Vitest development servers running the @vitest/mocker interceptorPlugin can have attacker-controlled JavaScript injected into generated module source, which then executes on the development-server origin when a developer's browser loads the poisoned module. Affected versions are 2.1.0-beta.7 through 4.1.12-exclusive and up to 5.0.3-exclusive; the root cause is that createManualModuleSource interpolates an attacker-supplied mock url into generated code without escaping, so an unauthenticated non-browser WebSocket client that can reach the dev server can register a manual mock containing a breakout payload. Exploitation is constrained (CVSS 4.7, AC:H, UI:R, S:C, C:L/I:L/A:N) because a developer must subsequently load the affected module in a browser and because the surface is a development-time server rather than production; no public exploit code was identified at time of analysis and the issue is not in CISA KEV.
A race condition in macOS Privacy preferences (TCC) enforcement allows a malicious application already running with normal user privileges to bypass privacy consent checks and read data the user never authorized, with confidentiality impact but no integrity or availability loss. The flaw affects macOS versions prior to 27, 15.8, and 26.7, and Apple has released fixes in those releases; the CVSS vector (AV:L/AC:H/PR:L) confirms only local, timing-dependent exploitation, and there is no public exploit identified at time of analysis. EPSS is low at 0.21% (10th percentile) and CISA SSVC rates exploitation as none, making this a moderate, low-priority issue rather than an urgent one.
Unauthorized update, insert, or delete access plus limited read access in Oracle Siebel CRM Integration's Open Integration component (versions 25.12 through 26.9) can be triggered by an unauthenticated network attacker over HTTP, but only in high-complexity scenarios that require a non-attacker user to perform an action. The scope-change rating means a successful attack may affect products beyond Siebel CRM Integration. No public exploit code or CISA KEV entry was identified at time of analysis, and Oracle characterizes the issue as difficult to exploit, keeping real-world risk low.
Python's filelock library, versions 4.1.0 through 4.2.0, allows a local attacker who is already contending on the same lock path to trick the SoftFileLock, MarkerSoftFileLock, and SoftFileLease implementations into deleting a legitimate holder's live marker file, silently breaking the mutual exclusion the lock is supposed to guarantee and letting concurrent processes enter a protected critical section together. Exploitation is not trivial: it requires a pre-dated attacker marker that is removed on cue, at least two waiting contenders, coarse or matching modification times that preserve the stale observation, and inode reuse on the filesystem (ext4 is the named enabler) so that an honest contender's fresh marker lands on the recycled inode. The impact is integrity-only with no confidentiality or availability component, the vector is strictly local and high-complexity (CVSS 4.7), no public exploit code was identified at time of analysis, and the flaw is fixed in 4.2.1.
Oracle BI Publisher's Web Server component, in versions 8.2.0.0.0, 12.2.1.4.0, and 26.01.0.0.0, exposes a CVSS 4.7 flaw through which a network-based, unauthenticated attacker can obtain limited unauthorized read access and perform limited insert/update/delete operations against BI Publisher data, with a scope change that may affect additional products. Successful exploitation requires the attacker to induce a user other than themselves to interact with a crafted HTTP request (UI:R) and is explicitly rated as difficult with high attack complexity (AC:H). No public exploit code and no CISA KEV entry were identified at time of analysis, and the mandatory victim interaction plus high complexity keep practical risk low-to-moderate despite network reachability.
Oracle PeopleSoft Enterprise PeopleTools 8.61 through 8.63 exposes an Integration Broker flaw that allows an unauthenticated attacker with network access over HTTP to influence data the application handles, with successful exploitation depending on inducing a legitimate user to interact with a crafted request and on conditions Oracle itself characterizes as difficult to arrange. Impact is partial - limited unauthorized read plus some unauthorized update, insert, or delete capability within PeopleTools-accessible data - with no availability effect, and because of the scope change the blast radius may extend to additional connected products; both confidentiality and integrity impacts are rated Low. No public exploit code and no confirmed active exploitation were identified at time of analysis, and the EPSS-style risk is correspondingly modest: this is a low-to-moderate real-world priority despite network reachability, warranting patching on a normal cycle rather than emergency response.
Unauthorized data modification and limited data disclosure in Oracle Siebel CRM End User (Open UI) can be triggered by an unauthenticated network attacker who convinces a legitimate user to interact with crafted content. Supported versions 17.0 through 26.9 are affected; Oracle rates the attack as high complexity and requires user interaction, with a scope change that may extend impact to integrated products. No public exploit code or CISA KEV entry is identified in the available data, and the 4.7 score reflects low confidentiality and integrity impact without availability loss.
Adjacent-network attackers with presence on the physical communication segment of the hardware hosting Oracle Siebel CRM Cloud Applications (Siebel Cloud Manager component, versions 22.3 through 26.9) can achieve limited unauthorized read access and update/insert/delete access to application data. Oracle's October 2026 CPU rates this 4.7 with a scope change (S:C), meaning downstream products may also be affected, but the attack is explicitly difficult to exploit (AC:H) and requires adjacent-segment positioning - not internet reachability - so no public exploit is identified at time of analysis and the CVE is not in CISA KEV. The practical risk is confined to insiders, compromised adjacent hosts, or parties with data-center/VLAN presence.
Unexpected system termination in Apple macOS can be triggered by a locally executed app that repeatedly hits a timing race inside a code path protected by insufficient locking. All macOS releases below macOS Golden Gate 27 are affected, and the vendor has shipped a fix in macOS Golden Gate 27. Impact is availability-only (no confidentiality or integrity effect), and the attack path is narrow: the attacker must already be running code on the host and must win a probabilistic, non-deterministic race condition, which keeps real-world risk low - EPSS is 0.14% (3rd percentile), CISA SSVC records exploitation as 'none' and automatable as 'no', and no public exploit code has been identified at time of analysis, with no KEV listing.
SoftFileLock, MarkerSoftFileLock, and SoftFileLease in the Python filelock package from 3.22.0 through 4.2.0 can be tricked into deleting a live holder's marker file, because the stale-owner check trusts a process identifier and start token stored in a marker that an attacker with write access to the same directory can rewrite but not remove (CWE-345). An authorized local contender - another process running under the holder's account, or root - can therefore act as a confused deputy, drop the live marker, and admit a second holder into a lock that should have stayed exclusive, undermining mutual exclusion for whatever resource the lock guards. The CVSS 3.1 vector scores this 4.7 (AV:L/AC:H/PR:L/UI:N/S:U/C:N/I:H/A:N), reflecting local-only access, high attack complexity, and integrity-only impact; no public exploit code and no confirmed active exploitation were identified at time of analysis, and the upstream advisory, PR #836, and commit eeceaa84 accompany the fixed release 4.2.1. Exploitation is further gated on non-default conditions - mismatched Linux time-namespace boottime offsets, an unreadable boot_id on one side, or direct marker rewriting - making this a genuine but narrowly scoped, lower-priority issue rather than a drop-everything emergency.
Integrity-only sandbox bypass in Oracle Java SE (8u503-perf, 11.0.32.1, 17.0.20.1, 21.0.12.1, 25.0.4.1 and 27), GraalVM for JDK (17.0.20.1, 21.0.12.1) and GraalVM Enterprise Edition (21.3.19.1.1) lets an unauthenticated attacker who can log on to the host tamper with, create or delete data that the JVM can reach - but only in deployments that still load and execute untrusted sandboxed content such as Java Web Start applications or applets, and only after a victim is persuaded to launch that content. Attack complexity is High, no confidentiality or availability impact is possible, and ordinary server deployments that run only administrator-installed code are explicitly out of scope. No public exploit code identified at time of analysis, and fixes are delivered through the referenced Oracle Critical Patch Update (October 2026).
Oracle Solaris 11.4 contains a denial-of-service flaw in its Libraries component that lets an attacker with local logon access hang or repeatedly crash the operating system, with no confidentiality or integrity impact. Exploitation is difficult: the CVSS 3.1 vector (AV:L/AC:H/PR:N/UI:R) requires local access, conditions outside the attacker's control, and a separate legitimate user or operator to perform a triggering action. No public exploit code or confirmed active exploitation was identified at time of analysis, and the 4.7 MEDIUM base score appropriately reflects a low-to-moderate priority issue.